CVE-2024-25885

7.5 highEPSS 0.6%

High (7.5). EPSS 0.6% chance of exploitation in the next 30 days.

An issue in the getcolor function in utils.py of xhtml2pdf v0.2.13 allows attackers to cause a Regular expression Denial of Service (ReDOS) via supplying a crafted string.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 50% of CVEs (scores of 2026-10-31)
CWE: CWE-1333
Published: 2024-10-08
Modified: 2026-07-05
Record from: the NVD, synced 2026-10-19

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-jj5c-hhrg-vv5h	PyPI	xhtml2pdf	<=0.2.16	no fix published
PYSEC-2026-2056	PyPI	xhtml2pdf	<=0.2.16	no fix published

References

https://gist.github.com/salvatore-abello/c88dd0027496774023ef36c7b576d206

Check your stack JSON